MongoDB Database Tools restore and file tool flaws
A database backup restore tool can let attackers create accounts.
Summary
Several flaws affect mongorestore and mongofiles in MongoDB Database Tools. Restoring an untrusted dump can create an attacker-chosen database account or mix data into another collection, and mongofiles can leak file contents to standard output or write files outside the working directory.
Affected when
- Restoring with an account that has user-management privileges on the destination
- Restoring an untrusted dump
- Retrieving files with mongofiles without --local
- An attacker able to place a symlink in the download working directory
What to do
Update to MongoDB Database Tools 100.20.1 or later.
Products and platforms
CVE IDs
Sources
Times
First published
First seen